Privacy preserving comparison

ABSTRACT

A method for performing a secure comparison between a first secret data and a second secret data, including: receiving, by a processor of a first party, encrypted bits of the second secret data y from a second party, where is an integer; computing the Hamming weight h of first secret data x, wherein x has bits; computing the value of a first comparison bit δA such that δA=0 when h&gt;└/2┘, δA=1 when h&lt;┌/2┐, and δA is randomly selected when h=/2; forming a set of └/2┘ indexes that includes at least the indexes i where xi=δA; selecting random invertible scalars ri for each i in and computing c*i=+(1+(1−2δA)xi·yi2δA−1·(xj⊕yj))ri wherein w denotes the homomorphic encryption of w using a cryptographic key of the second party; selecting random invertible scalars r−1 and computing c*−1=(δA·xj⊕yj)r−1; transmitting ciphertexts c*i in a random order to the second party.

TECHNICAL FIELD

Various exemplary embodiments disclosed herein relate generally to a method and apparatus for performing a privacy preserving comparison.

BACKGROUND

Protocols have been developed for comparing private values using homomorphic encryption. Embodiments improving upon the state of the art will be described below.

SUMMARY

A brief summary of various exemplary embodiments is presented below. Some simplifications and omissions may be made in the following summary, which is intended to highlight and introduce some aspects of the various exemplary embodiments, but not to limit the scope of the invention. Detailed descriptions of an exemplary embodiment adequate to allow those of ordinary skill in the art to make and use the inventive concepts will follow in later sections.

Various embodiments relate to a method for performing a secure comparison between a first secret data and a second secret data, including: receiving, by a processor of a first party,

encrypted bits of the second secret data y from a second party, where

is an integer; computing the Hamming weight h of first secret data x, wherein x has

bits; computing the value of a first comparison bit δ_(A) such that δ_(A)=0 when h>└

/2┘, δ_(A)=1 when h<┌

/2┐, and δ_(A) is randomly selected when h=

/2; forming a set of └

/2┘ indexes

that includes at least the indexes i where x_(i)=δ_(A); selecting random invertible scalars r_(i) for each i in

and computing

c*_(i)

=(

1+(1−2δ_(A))x_(i)

·

y_(i)

^(2δ) ^(A) ⁻¹·(

x_(j)⊕y_(j)

))^(r) ^(i) wherein

w

denotes the homomorphic encryption of w using a cryptographic key of the second party; selecting random invertible scalars r⁻¹ and computing

c*⁻¹

=(

δ_(A)

·

x_(j)⊕y_(j)

)^(r) ⁻¹ ; transmitting ciphertexts

c*_(i)

in a random order to the second party.

Further various embodiments relate to a non-transitory machine-readable storage medium encoded with instructions for performing a secure comparison between a first secret data and a second secret data, including: instructions for receiving, by a processor of a first party,

encrypted bits of the second secret data y from a second party, where

is an integer; instructions for computing the Hamming weight h of first secret data x, wherein x has

bits; instructions for computing the value of a first comparison bit δ_(A) such that δ_(A)=0 when h>└

/2┘, δ_(A)=1 when h<┌

/2┐, and δ_(A) is randomly selected when h=

/2; instructions for forming a set of └

/2┘ indexes

that includes at least the indexes i where x_(i)=δ_(A); instructions for selecting random invertible scalars r_(i) for each i in

and computing

c*_(i)

=+(

1+(1−2δ_(A))x_(i)

·

y_(i)

^(2δ) ^(A) ⁻¹·(

x_(j)⊕y_(j)

))^(r) ^(i) wherein

w

denotes the homomorphic encryption of w using a cryptographic key of the second party; instructions for selecting random invertible scalars r⁻¹ and computing

c*⁻¹

=(

δ_(A)

·

x_(j)⊕y_(j)

)^(r) ⁻¹ ; instructions for transmitting ciphertexts

c*_(i)

in a random order to the second party.

Various embodiments are described, wherein when the second party sets a value of a second comparison bit δ_(B) based upon the decrypted c*_(i)'s and wherein δ_(A)⊕δ_(B)=[x≤y].

Various embodiments are described, wherein when the second party sets a second comparison bit δ_(B)=1 when any one of the decrypted c*_(i)'s is equal to zero.

Various embodiments are described, wherein when the second party sets a second comparison bit δ_(B)=0 when none of the decrypted c*_(i)'s is equal to zero.

Various embodiments are described, wherein the encryption uses the Pallier cryptosystem.

Various embodiments are described, wherein the encryption uses the exponential variant of the ElGamal cryptosystem.

Various embodiments are described, further including receiving an encryption of the second comparison bit δ_(B) from the second party and computing

δ

=

δ_(B)

when δ_(A)=0 and

δ

=

1

·

δ_(B)

⁻¹ when δ_(A)≠0, wherein δ=[x≤y].

Further various embodiments relate to a method for performing a secure comparison between a first secret data and a second secret data, including: receiving, by a processor of a first party, encrypted second secret data

y

from a second party, wherein where

is the number of bits in y and wherein

y

denotes the additive homomorphic encryption of y; choosing a random mask ρ in

, where κ is a security parameter; computing

z^(†)

=

y

·

x

⁻¹·

+ρ

, wherein x is the first secret data having

bits; sending

z^(†)

to the second party; computing x′=ρ mod

; receiving, by the processor of a first party,

encrypted bits of y′ from the second party, wherein y′ is based upon

z^(†)

; computing the Hamming weight h of x′; computing the value of a first comparison bit δ′_(A) such that δ′_(A)=0 when h>└

/2┘, δ′_(A)=1 when h<┌

/2┐, and δ′_(A) is randomly selected when h=

/2; forming a set of └

/2┘ indexes

that includes at least the indexes i where x′_(i)=δ′_(A); selecting random invertible scalars r_(i) for each i in

and computing

c*_(i)

=(

1+(1−2δ′_(A))x′_(i)

·

y′_(i)

^(2δ′) ^(A) ⁻¹·(

x′_(j)⊕y′_(j)

))^(r) ^(i) ; selecting random invertible scalars r⁻¹ and computing

c*⁻¹

=(δ′_(A)

·

x′_(j)⊕y′_(j)

)^(r) ⁻¹ ; transmitting ciphertexts

c_(i)*

in a random order to the second party.

Further various embodiments relate to a non-transitory machine-readable storage medium encoded with instructions for performing a secure comparison between a first secret data and a second secret data, including: instructions for receiving, by a processor of a first party, encrypted second secret data

y

from a second party, wherein where

is the number of bits in y and wherein

y

denotes the additive homomorphic encryption of y; instructions for choosing a random mask ρ in

, where κ is a security parameter; instructions for computing

z^(†)

=

y

·

x

⁻¹·

+ρ

, wherein x is the first secret data having

bits; instructions for sending

z^(†)

to the second party; instructions for computing x′=ρ mod 2

; instructions for receiving, by the processor of a first party,

encrypted bits of y′ from the second party, wherein y′ is based upon

z^(†)

; instructions for computing the Hamming weight h of x′; instructions for computing the value of a first comparison bit δ′_(A) such that δ′_(A)=0 when h>└

/2┘, δ′_(A)=1 when h<┌

/2┐, and δ′_(A) is randomly selected when h=

/2; instructions for forming a set of └

/2┘ indexes

that includes at least the indexes i where x′_(i)=δ′_(A); instructions for selecting random invertible scalars r_(i) for each i in

and computing

c_(i)*

=(

1+(1−2δ′_(A))x′_(i)

·

y′_(i)

^(2δ′) ^(A) ⁻¹·(

x′_(j)⊕y′_(j)

))^(r) ^(i) ; instructions for selecting random invertible scalars r⁻¹ and computing

c*⁻¹

=(δ′_(A)

·

x′_(j)⊕y′_(j)

)^(r) ⁻¹ ; instructions for transmitting ciphertexts

c_(i)*

in a random order to the second party.

Various embodiments are described, wherein when the second party decrypts

z^(†)

and defines y′=z^(†) mod

.

Various embodiments are described, wherein the first party sets δ_(A)=δ′_(A) when └ρ/

┘ is even, and δ_(A)=1−δ′_(A) otherwise, second party sets a value of a second comparison bit δ_(B)=δ′_(B) when └z^(†)/

┘ is odd, and δ_(B)=1−δ′_(B) otherwise and wherein δ_(A)⊕δ_(B)=[x≤y].

BRIEF DESCRIPTION OF THE DRAWINGS

In order to better understand various exemplary embodiments, reference is made to the accompanying drawings, wherein:

FIG. 1 illustrates a first embodiment of a privacy comparison protocol; and

FIG. 2 illustrates a second embodiment of a privacy comparison protocol.

To facilitate understanding, identical reference numerals have been used to designate elements having substantially the same or similar structure and/or substantially the same or similar function.

DETAILED DESCRIPTION

The description and drawings illustrate the principles of the invention. It will thus be appreciated that those skilled in the art will be able to devise various arrangements that, although not explicitly described or shown herein, embody the principles of the invention and are included within its scope. Furthermore, all examples recited herein are principally intended expressly to be for pedagogical purposes to aid the reader in understanding the principles of the invention and the concepts contributed by the inventor(s) to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions. Additionally, the term, “or,” as used herein, refers to a non-exclusive or (i.e., and/or), unless otherwise indicated (e.g., “or else” or “or in the alternative”). Also, the various embodiments described herein are not necessarily mutually exclusive, as some embodiments can be combined with one or more other embodiments to form new embodiments.

A comparison compares two

-bit integers to decide whether or not x≤y. This problem arises in a variety of privacy-preserving applications including secure data mining and secure auctions.

There exist different versions of the problem depending on whether the numbers x and y are known to the respective parties or unknown to everyone, and whether the result of the comparison is public or private. In this disclosure, it is assumed that two parties have two integers (in the clear) and that they want to compare these numbers without revealing the value. Embodiments of the comparison protocol described below can also be used in the case where one of the parties has the encrypted integers and the other party has the key to decrypt encrypted integers and in this case both integers will remain unknown to the parties. The final result of the comparison protocol can be public or secretly shared between the parties.

The embodiments of the disclosure introduce new comparison protocols which increase the efficiency in both communication and computational complexities by about a factor of two as compared to the current state of the art. These embodiments include the following features:

-   -   Performing the comparison based on the Hamming weight of the         integer x. These embodiments are designed in a way that         guarantees having at most

$\left\lfloor \frac{}{2} \right\rfloor + 1$

bit comparisons, which leads to a better performance.

-   -   The protocols are cryptographically secure. By possibly adding         dummy comparisons, the protocols become robust against timing         attacks as well.     -   In order to hide the information of Hamming weight of x from the         other party, a sub-protocol is introduced that generates random         shares and compares those shares.     -   The protocols described may be applied to increase the         efficiency of any comparison     -   protocol based on bit-wise comparison. See e.g., Hsiao-Ying Lin         and Wen-Guey Tzeng. An efficient solution to the millionaires'         problem based on homomorphic encryption. In J. Ioannidis, A. D.         Keromytis, and M. Yung, editors, Applied Cryptography and         Network Security (ACNS 2005), volume 3531 of Lecture Notes in         Computer Science, pages 456-466. Springer, 2005. In order to         provide a concrete example in the embodiments described herein         the well-known DGK comparison protocol is used. See Ivan         Damgård, Martin Geisler, and Mikkel Krøigaard, Homomorphic         encryption and secure comparison, International Journal of         Applied Cryptography, 1(1):22-31, 2008.

Damgård, Geisler, and Krøigaard present an elegant protocol for comparing private values. It was later modified in: Zekeriya Erkin, Martin Franz, Jorge Guajardo, Stefan Katzenbeisser, Inald Lagendijk, and Tomas Toft, Privacy-preserving face recognition, In I. Goldberg and M. J. Atallah, editors, Privacy Enhancing Technologies (PETS 2009), volume 5672 of Lecture Notes in Computer Science, pages 235-253. Springer, 2009; and Thijs Veugen. Improving the DGK comparison protocol, In 2012 IEEE International Workshop on Information Forensics and Security (WIFS 2012), pages 49-54. IEEE, 2012.

The comparison protocol utilizes an additively homomorphic encryption scheme. Let

m

denote the encryption of a message m. The homomorphic property implies that for any two messages m and m′, the encryption of m+m′ can be obtained from the encryptions of m and m′ as

m+m′

=

m

·

m′

for some public operation “·”. Likewise, for a known constant integer d, the encryption of dm (that is, m+m+ . . . +m (d times)) can be obtained from the encryption of m as

dm

=

m

^(d). Examples of additively homomorphic encryption schemes include the Paillier cryptosystem or the exponential variant of the ElGamal encryption scheme.

The DGK+ protocol, a variation on the Damgård-Geisler-Krøigaard protocol, will now be described. Alice possesses a private

-bit value x=

x_(i)2^(i) while Bob possesses a private

-bit value y=

y_(i)2^(i). The goal for Alice and Bob is to respectively obtain bits δ_(A) and δ_(B) such that δ_(A)⊕δ_(B)=[x≤y]. Here [x≤y] denotes the result of the comparison: [x≤y]=1 (true) if x≤y, and [x≤y]=0 (false) if x>y. The protocol proceeds in four steps:

-   -   1. Bob encrypts the bits of y=         y_(i)2^(i) under his public key and sends         y_(i)         , 0≤i≤         −1, to Alice.     -   2. Alice chooses uniformly at random a bit δ_(A)∈{0,1} and         defines s=1−2δ_(A). Alice also selects         +1 random invertible scalars r_(i), −1≤i≤         −1.     -   3. Next, for         −1≥i≥0, Alice computes

c* _(i)

=(

s

·

x _(i)

·

y _(i)

⁻¹·(

x _(j) ⊕y _(j)

)³)^(r) ^(i) .

-   -   Finally, Alice computes

c* ⁻¹

=(

δ_(A)

·

x _(j) ⊕y _(j)

)^(r) ⁻¹ .

-   -   Alice sends the         +1 ciphertexts c_(i)* in a random order to Bob.     -   4. Using his private key, Bob decrypts the received         c_(i)*         's. If one is decrypted to zero, Bob sets δ_(B)=1. Otherwise,         Bob sets δ_(B)=0.         Note that given         y_(i)         , Alice can obtain         x_(i)⊕y_(i)         as

${〚{x_{i} \oplus y_{i}}〛} = \left\{ {\begin{matrix} {{〚y_{i}〛}\mspace{76mu}} & {{{if}\mspace{14mu} x_{i}} = 0} \\ {{〚1〛} \cdot {〚y_{i}〛}^{- 1}} & {{{if}\mspace{14mu} x_{i}} = 1} \end{matrix}.} \right.$

The correctness of the DGK+ protocol follows from the fact that x=(

, . . . , x₀) is smaller than or equal to y=(

, . . . , y₀) if only and only if

-   -   1. x=y, or     -   2. there exists some index i, with 0≤i≤         −1, such that

x_(i)<y_(i), and

x _(j) =y _(j) for

−1≥j≥i+1.

When x≠y, this latter condition is equivalent to the existence of some index i, with 0≤i≤

−1, such that x_(i)−y_(i)+1+

(x_(j)⊕y_(j))=0. Indeed, because (x_(i)−y_(i)+1)≥0 and (x_(j)⊕y_(j))≥0, it follows that x_(i)−y_(i)+1+

(x_(j)⊕y_(j))=0 is equivalent to x_(i)−y_(i)+1=0 and (x_(j)⊕y_(j))=0 for all j≥i+1, which in turn is equivalent to x_(i)<y_(i) and x_(j)=y_(j) for all j≥i+1.

Let δ_(A)∈{0,1}. The above test is replaced to allow the secret sharing of the comparison bit across Alice and Bob as [x≤y]=δ_(A)⊕δ_(B). The new test checks the existence of some index i, with 0≤i≤

−1, such that

c _(i) =x _(i) −y _(i)+(1−2δ_(A))+3

(x _(j) ⊕y _(j))

is zero. When δ_(A)=0 this occurs if x≤y; when δ_(A)=1 this occurs if x>y. As a result, the first case yields δ_(A)=¬[x<y]=1⊕[x≤y] while the second case yields δ_(A)=[x>y]=¬[x≤y]=1⊕[x≤y]. This discrepancy is corrected by augmenting the set of c_(i)'s with an additional value c⁻¹ given by

c ⁻¹=δ_(A)+

(x _(j) ⊕y _(j)).

It is worth observing that c⁻¹ can only be zero when δ_(A)=0 and x=y. Therefore, in all cases, when there exists some index i, with −1≤i≤

−1, such that c_(i)=0, then δ_(A)=1⊕[x≤y], or equivalently, [x≤y]=δ_(A)⊕1.

It is easily verified that

c_(i)*

as computed in step 3 of the DGK+ protocol is the encryption of r_(i)c_(i). Clearly, if r_(i)c_(i) is zero then so is c_(i) because r_(i)≠0. Hence, if one of the

c*_(i)

's decrypts to 0 then [x≤y]=δ_(A)⊕1=δ_(A)⊕δ_(B); if not, one has [x≤y]=δ_(A)=δ_(A)⊕δ_(B). This concludes the proof of correctness.

In section II-A of Veugen, the author does not explicitly mention that c⁻¹ has to be randomized by an invertible scalar r⁻¹. This step is important as otherwise, assuming δ_(A)=1 (which occurs with probability ½), if Bob decrypts one of the

c*_(i)

's to 1, he can deduce that x is very likely equal to y.

The Damgård-Geisler-Kr

igaard (DKG) protocol has the disadvantage of being computational intensive. Step 3 of the DKG protocol is dominated by

+1 exponentiations in the group underlying the homomorphic encryption scheme. Those are costly operations. This issue was addressed in Veugen. Veugen was able to divide the computational workload by approximately a factor of two. However, the resulting implementation is subject to timing attacks. Another drawback of the DKG protocol is the communication cost. Step 3 in the DKG protocol produces

+1 ciphertexts that are transmitted from Alice to Bob.

An embodiment of a comparison method will now be described that reduces by roughly a factor of two both the computational complexity and the necessary bandwidth for step 3. Furthermore, provided it is properly implemented, the proposed method is resistant against timing attacks.

The same setting as described above will be used again where Alice possesses an

-bit integer x and Bob possesses an

-bit integer y. The goal is for Alice and Bob to respectively obtain bits δ_(A) and δ_(B) such that δ_(A)⊕δ_(B)=[x≤y].

A first embodiment of the privacy comparison protocol, as illustrated in FIG. 1, proceeds as follows.

-   -   1. Bob encrypts the bits of y=         y_(i)2^(i) under his public key and sends         y_(i)         , 0≤i≤         −1, to Alice 110.     -   2. Alice computes the Hamming weight of x (i.e., the number of         nonzero bits of x) 115. Let h denote the Hamming weight of x.         The value of δ_(A) is set based upon the Hamming weight h 120.         There are three cases to consider:         -   (a) if h>└l/2┘, Alice sets δ_(A)=0;         -   (b) if h<┌l/2┐, Alice sets δ_(A)=1;         -   (c) if h=             /2 (this can only occur when             is even), Alice chooses a random value in {0,1} for δ_(A).     -   3. Next, Alice forms a set         of indexes i 125 such that         -   (a)             ⊇             ′ where             ′={0≤i≤             −1|x_(i)=δ_(A)}; and         -   (b) #             =└             /2┘.     -   For each i∈         , Alice selects a random invertible scalar r_(i) 130 and         computes 135

c* _(i)

=(

1+(1−2δ_(A))x _(i)

·

y _(i)

^(2δ) ^(A) ⁻¹·(

x _(j) ⊕y _(j)

))^(r) ^(i) .

-   -   Finally, Alice computes 140

c* ⁻¹

=(

δ_(A)

·

x _(j) ⊕y _(j)

)^(r) ⁻¹ .

-   -   Alice sends the └         /2┘+1 ciphertexts         c_(i)*         in a random order to Bob 145.     -   4. Using his private key, Bob decrypts the received         c*_(i)         's. If one is decrypted to zero, Bob sets δ_(B)=1 150.         Otherwise, Bob sets δ_(B)=0.

The correctness of this protocol will now be discussed. It is useful to introduce some notation. For a t-bit integer a=Σ_(i=0) ^(t−1)a_(i)2^(i) with a_(i)∈{0,1}, let ā denote the complementary of a; i.e., ā=2^(t)−a−1. In particular, for t=1, a=a₀ and ā=ā₀=1−a₀.

As a first proposition let x=

x_(i)2^(i) and y=

y_(i)2^(i), with x_(i), y_(i)∈{0,1}, be two

-bit integers. Define

$c_{i} = {x_{i} + \overset{\_}{y_{i}} + {\sum\limits_{j = {i + 1}}^{ - 1}\; {\left( {x_{j} \oplus y_{j}} \right).}}}$

Then x<y if and only if there exists some unique index i with 0≤i≤

−1 such that c_(i)=0.

This may be proved as follows. As defined, c_(i) is the sum of nonnegative terms. Therefore, c_(i)=0 is equivalent to (i) x_(i)=y _(i)=0 and (ii) for i+1≤j≤

−1, x_(j)⊕y_(j)=0. This in turn is equivalent to (i) x_(i)<y_(i) and (ii) for i+1≤j≤

−1, x_(j)=y_(j); that is, x<y. To see that if an index i exists, such that c_(i)=0 is unique, suppose that c_(i′)=0 for some i′≠i. Without loss of generality, assume that i′<i. Then, c_(i′)=x_(i′)+y_(i′) +

(x_(j)⊕y_(j))≥x_(i)⊕y_(i)=1, which is a contradiction.

As second proposition, let x=

x_(i)2^(i) and y=

y_(i)2^(i), with x_(i), y_(i)∈{0,1}, be two

-bit integers. Define

$c_{- 1} = {\sum\limits_{j = 0}^{ - 1}\; {\left( {x_{j} \oplus y_{j}} \right).}}$

Then x=y if and only if c⁻¹=0. The proof is obvious.

By reversing the roles of x and y in the first proposition, the following corollary results: as a third proposition let x=

x_(i)2^(i) and y=

y_(i)2^(i), with x_(i), y_(i)∈{0,1}, be two

-bit integers. Define

$c_{i} = {y_{i} + \overset{\_}{x_{i}} + {\sum\limits_{j = {i + 1}}^{ - 1}\; {\left( {y_{j} \oplus x_{j}} \right).}}}$

Then x≤y if and only if there exists no index i with 0≤i≤

−1 such that c_(i)=0.

This may be proved as follows. If there were such an index i, this would imply y<x by the first proposition. The absence of such an index therefore implies y≥x.

Suppose first that the Hamming weight of x is greater than └

/2┘ (and thus δ_(A)=0). This means that x has more ones than zeros in its binary representation. Specifically, among the

bits of x, at most └

/2┘ bits are equal to 0. Furthermore, the first proposition shows that c_(i) needs only to be evaluated when x_(i)=0 because when x_(i)=1, it is already known that the corresponding c_(i) cannot be zero. The case x=y is taken into account using the second proposition.

Now suppose that the Hamming weight of x is less than ┌

/2┐ (and thus δ_(A)=1). In this case, among the

bits of x, at most └

/2┘ bits are equal to 1. Then the second proposition can be made use of: with at most └

/2┘ tests for c_(i)=0 (i.e., when x_(i)=1), it can be decided whether x≤y.

The last case is when the Hamming weight of x is

/2 (and thus δ_(A) is equiprobably equal to 0 or 1). This supposes

even. In this case, among the

bits of x,

/2 bits are equal to 0 and

/2 bits are equal to 1. The combination of the first and second propositions or the third proposition can be used indifferently to decide after at most

/2=└

/2┘ tests for c_(i)=0 whether or not x≤y.

The above analysis shows that (i) only the indexes i∈

′ need to be tested, and (ii) #

′≤└

/2┘. If #

′<└l/2┘ then additional indexes are added to

′ to form

. This ensures that #

is always equal to └

/2┘ and is aimed at preventing timing attacks. Since the values of r_(i)c_(i) is nonzero for i∉

′, the correctness follows by noting that the c*_(i)'s include the encryptions of r_(i)c_(i) for all i∈

′.

By construction, δ_(B)=1 if one of the

c*_(i)

's decrypts to 0.

-   -   1. When δ_(A)=0, the first and second propositions are used. A         decryption to 0 means x≤y, and therefore [x≤y]=1=δ_(A)⊕δ_(B), as         desired.     -   2. When δ_(A)=1, the third proposition is used and a decryption         to 0 means x≤y. Then, [x≤y]=0=δ_(A)⊕δ_(B), as desired.

If none of the

c*_(i)

's decrypts to 0, then δ_(B)=0. When δ_(A)=0, this means x≤y; when δ_(A)=1, this means x≤y. In both cases, [x≤y]=δ_(A)⊕δ_(B), as desired.

A second embodiment of a comparison method will now be described. In the setting where Alice possesses x and Bob y and where Alice and Bob wish to respectively obtain δ_(A) and δ_(B) such that δ_(A)⊕δ_(B)=6 with δ=[x≤y], the previously described first protocol needs special care. In particular, it requires that the Hamming weight of x a priori has the same probability to be greater than └

/2┘ or less than ┌

/2┐. This guarantees that δ_(A) is uniformly distributed over {0,1}. Indeed, if Bob knows for example that the Hamming weight of x is more likely greater than └

/2┘ (and thus δ_(A) is more likely equal to 1), a value δ_(B)=0 tells Bob that x is more likely less or equal to y because δ_(A)⊕δ_(B)=[x≤y].

The second embodiment described below is secure even when Bob has some a priori knowledge on the Hamming weight of x. The distribution of δ_(A) will always be uniform over {0,1}, independently of the value of x.

The second embodiment of the privacy comparison protocol, as shown in FIG. 2, proceeds as follows.

-   -   1a. Bob encrypts y under his public key and sends         y         to Alice 210.     -   1b. Alice chooses a random mask ρ in         215, where κ is a security parameter, and computes         z^(†)         =         y         ·         x         ⁻¹·         +ρ         220, and sends         z^(†)         to Bob 225.     -   1c. Alice defines x′=ρ mod         230.     -   1d. Using his private key, Bob decrypts         z^(†)         and gets z^(†), and defines y′=z^(†) mod         .     -   2. Alice and Bob now apply the previous comparison protocol on         x′ and y′ 235-280 (similar to FIG. 1). Let δ′_(A) and δ′_(B)         denote the respective outputs for Alice and Bob of the protocol,         with δ′_(A)⊕δ′_(B)=[x′≤y′].     -   3. Alice sets δ_(A)=δ′_(A) if └ρ/         ┘ is even, and δ_(A)=1−δ′_(A) otherwise.     -   4. Bob sets δ_(B)=δ′_(B) if └z^(†)/         ┘ is odd, and δ_(B)=1−δ′_(B) otherwise.         It is worth noting here that x′ as defined in Step 3 is a random         -bit integer. There is therefore no way for Bob to gain more         information on its Hamming weight.

The correctness of this protocol will now be discussed.

Define X′=└ρ/

┘, Y′=└z^(†)/

┘, and δ′=δ′_(A)⊕δ′_(B). The values for δ_(A) and δ_(B) such that δ_(A)⊕δ_(B)=[x≤y] can be obtained from δ′_(A) and δ′_(B), respectively. Indeed:

$\begin{matrix} {{\delta_{A} \oplus \delta_{B}} = {\left\lbrack {x \leq y} \right\rbrack = \left\lfloor \frac{y + 2^{} - x}{2^{}} \right\rfloor}} \\ {= {\left\lfloor \frac{z^{\dagger} - \rho}{2^{}} \right\rfloor = {\left\lfloor \frac{\left( {{Y^{\prime}2^{}} + y^{\prime}} \right) - \left( {{X^{\prime}2^{}} + x^{\prime}} \right)}{2^{}} \right\rfloor = {Y^{\prime} - X^{\prime} + \left\lfloor \frac{y^{\prime} - x^{\prime}}{2^{}} \right\rfloor}}}} \\ {= {{Y^{\prime} - X^{\prime} + \delta^{\prime} - 1}=={Y^{\prime} - X^{\prime} + \left( {\delta_{A}^{\prime} \oplus \delta_{B}^{\prime}} \right) - 1.}}} \end{matrix}$

Therefore, modulo 2, one has:

δ_(A)+δ_(B) ≡Y′+X′+δ′ _(A)+δ′_(B)+1(mod 2);

a solution of which is: δ_(A)=(δ′_(A)+X′) mod 2 and δ_(A)=(δ′_(B)+Y′+1) mod 2.

The first and second embodiments may also produce an encrypted comparison bit as will now be described. Let δ denote the comparison bit; i.e., δ=[x≤y]. In certain settings, Alice wishes to produce an encryption of δ at the end of the protocol, rather than a share δ_(A) of δ (the other share, δ_(B), being held by Bob). In this case, following step may be added to the first and second embodiments of the comparison protocols:

-   -   5. Bob encrypts δ_(B) using his public key and sends         δ_(B)         to Alice. Upon receiving         δ_(B)         , Alice computes         δ         as

${〚\delta 〛} = \left\{ \begin{matrix} {{〚\delta_{B}〛}\mspace{76mu}} & {{{{{if}\mspace{14mu} \delta_{A}} = 0},}\;} \\ {{〚1〛} \cdot {〚\delta_{B}〛}^{- 1}} & {{otherwise}.} \end{matrix} \right.$

In yet other embodiments, the inputs may be encrypted. There exists another practical setting for the comparison of private inputs. In this setting, Alice possesses

{circumflex over (x)}

and

ŷ

, the encryption of two

-bit values {circumflex over (x)}=

{circumflex over (x)}_(i)2^(i) and ŷ=

ŷ_(i)2^(i). Bob possesses the corresponding decryption key. The goal is for Alice to get

{circumflex over (δ)}

, the encryption under Bob's public key of the comparison bit {circumflex over (δ)}=[{circumflex over (x)}≤ŷ]. The protocols described in the embodiments above may be used in that setting as well. Let κ be a security parameter. Alice first chooses a random (

+κ)-bit integer μ and, from

{circumflex over (x)}

and

ŷ

, computes

z*

where

z*=ŷ+

−{circumflex over (x)}+μ

as

z*

=

ŷ

·

{circumflex over (x)}

⁻¹·

+μ

. Alice also defines x=μ mod

. Alice sends

z*

to Bob.

Bob decrypts

z*

to get z* and defines y=z* mod

.

Again, it is worth noting that x and y are

-bit integers privately held by Alice and Bob, respectively. This is a setting similar to the one considered above. Let δ=[x≤y] and assume that Alice obtained

δ

as the output of the first or second comparison protocol embodiments. It will be shown below how Alice can get

{circumflex over (δ)}

from

δ

.

Define X=└μ/

┘ and Y=└z*/

┘. Note that the problem of finding

{circumflex over (δ)}

boils down to the problem of finding

δ

. Indeed:

$\begin{matrix} {\hat{\delta} = {\left\lbrack {\hat{x} \leq \hat{y}} \right\rbrack = \left\lfloor \frac{\hat{y} + 2^{} - \hat{x}}{2^{}} \right\rfloor}} \\ {= {\left\lfloor \frac{z^{*} - \mu}{2^{}} \right\rfloor = {\left\lfloor \frac{\left( {{Y\; 2^{}} + y} \right) - \left( {{X\; 2^{}} + x} \right)}{2^{}} \right\rfloor = {Y - X + \left\lfloor \frac{y - x}{2^{}} \right\rfloor}}}} \\ {{= {Y - X + \delta - 1}};} \end{matrix}$

hence, Alice may compute

{circumflex over (δ)}

from

δ

and

Y

as

{circumflex over (δ)}

=

Y

·

X+1

⁻¹·

δ

.

It suffices that Bob sends the value of

Y

to Alice.

The embodiments described herein may be used in various applications. The comparison of private values is an essential building block for developing privacy-preserving machine-learning algorithms. These include the very popular SVM (support vector machines) algorithm as well as k-means clustering. In secure clustering algorithm, user profile should be compared with cluster centroids.

Comparison protocols also have a pivotal role in authentication services. In fingerprint-based authentication, a biometric device (fingerprint reader) identifies a user by comparing her sample with the database of authorized entities. It is also used in face recognition. In private recommender systems, the user value is compared with a threshold. Comparison algorithms also have applications in secure matrix factorization, private bio-informatic services, and secure adaptive filtering.

The embodiments described in this disclosure therefore find numerous applications. Remarkably, the resulting performance is greatly improved compared to state-of-the-art methods, both in computation and communication complexities.

The embodiments described herein represent an improvement in the technology of secure comparisons of data by a single party who does not have access to the underlying secure data or between two parties who are keeping their own information secret from the other party. These embodiments provide a reduction in the amount of computations needed to perform these secure comparisons as well as reducing the amount of data that needed to be exchanged between the parties doing the comparison. As a result, the embodiments also lead to an improvement in terms of number of operations of a computer that may be used to carry out such secure comparisons.

The methods described above may be implemented in software which includes instructions for execution by a processor stored on a non-transitory machine-readable storage medium. The processor may include a memory that stores the instructions for execution by the processor.

Any combination of specific software running on a processor to implement the embodiments of the invention, constitute a specific dedicated machine.

As used herein, the term “non-transitory machine-readable storage medium” will be understood to exclude a transitory propagation signal but to include all forms of volatile and non-volatile memory. Further, as used herein, the term “processor” will be understood to encompass a variety of devices such as microprocessors, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), and other similar processing devices. When software is implemented on the processor, the combination becomes a single specific machine.

It should be appreciated by those skilled in the art that any block diagrams herein represent conceptual views of illustrative circuitry embodying the principles of the invention.

Although the various exemplary embodiments have been described in detail with particular reference to certain exemplary aspects thereof, it should be understood that the invention is capable of other embodiments and its details are capable of modifications in various obvious respects. As is readily apparent to those skilled in the art, variations and modifications can be effected while remaining within the spirit and scope of the invention. Accordingly, the foregoing disclosure, description, and figures are for illustrative purposes only and do not in any way limit the invention, which is defined only by the claims. 

What is claimed is:
 1. A method for performing a secure comparison between a first secret data and a second secret data, comprising: receiving, by a processor of a first party,

encrypted bits of the second secret data y from a second party, where

is an integer; computing the Hamming weight h of first secret data x, wherein x has

bits; computing the value of a first comparison bit δ_(A) such that δ_(A)=0 when h>└

/2┘, δ_(A)=1 when h<┌

/2┐, and δ_(A) is randomly selected when h=

/2; forming a set of └

/2┘ indexes

that includes at least the indexes i where x_(i)=δ_(A); selecting random invertible scalars r_(i) for each i in

and computing

c* _(i)

=(

1+(1−2δ_(A))x _(i)

·

y _(i)

^(2δ) ^(A) ⁻¹·(

x _(j) ⊕y _(j)

))^(r) ^(i) wherein

w

denotes the homomorphic encryption of w using a cryptographic key of the second party; selecting random invertible scalars r⁻¹ and computing

c* ⁻¹

=(

δ_(A)

·

x _(j) ⊕y _(j)

)^(r) ⁻¹ ; transmitting ciphertexts

c*_(i)

in a random order to the second party.
 2. The method of claim 1, wherein when the second party sets a value of a second comparison bit δ_(B) based upon the decrypted c*_(i)'s and wherein δ_(A)⊕δ_(B)=[x≤y].
 3. The method of claim 2, wherein when the second party sets a second comparison bit δ_(B)=1 when any one of the decrypted c*_(i)'s is equal to zero.
 4. The method of claim 2, wherein when the second party sets a second comparison bit δ_(B)=0 when none of the decrypted c*_(i)'s is equal to zero.
 5. The method of claim 1, wherein the encryption uses the Pallier cryptosystem.
 6. The method of claim 1, wherein the encryption uses the exponential variant of the ElGamal cryptosystem.
 7. The method of claim 1, further comprising receiving an encryption of the second comparison bit δ_(B) from the second party and computing

δ

=

δ_(B)

when δ_(A)=0 and

δ

=

1

·

δ_(B)

⁻¹ when δ_(A)≠0, wherein δ=[x≤y].
 8. A method for performing a secure comparison between a first secret data and a second secret data, comprising: receiving, by a processor of a first party, encrypted second secret data

y

from a second party, wherein where

is the number of bits in y and wherein

y

denotes the additive homomorphic encryption of y; choosing a random mask ρ in

, where κ is a security parameter; computing

z^(†)

=

y

·

x

⁻¹·

+ρ

, wherein x is the first secret data having

bits; sending

z^(†)

to the second party; computing x′=ρ mod

; receiving, by the processor of a first party,

encrypted bits of y′ from the second party, wherein y′ is based upon

z^(†)

; computing the Hamming weight h of x′; computing the value of a first comparison bit δ′_(A) such that δ′_(A)=0 when h>└

/2┘, δ′_(A)=1 when h<┌

/2┐, and δ′_(A) is randomly selected when h=

/2; forming a set of └

/2┘ indexes

that includes at least the indexes i where x′_(i)=δ′_(A); selecting random invertible scalars r_(i) for each i in

and computing

c* _(i)

=(

1+(1−2δ′_(A))x′ _(i)

·

y′ _(i)

^(2δ′) ^(A) ⁻¹·(

x _(j) ⊕y _(j)

))^(r) ^(i) ; selecting random invertible scalars r⁻¹ and computing

c* ⁻¹

=(δ′_(A)

·

x′ _(j) ⊕y′ _(j)

)^(r) ⁻¹ ; transmitting ciphertexts

c*_(i)

in a random order to the second party.
 9. The method of claim 8, wherein when the second party decrypts

z^(†)

and defines y′=z^(†) mod

.
 10. The method of claim 8, wherein the first party sets δ_(A)=δ′_(A) when └ρ/

┘ is even, and δ_(A)=1−δ′_(A) otherwise, second party sets a value of a second comparison bit δ_(B)=δ′_(B) when └z^(†)/

┘ is odd, and δ_(B)=1−δ′_(B) otherwise and wherein δ_(A)⊕δ_(B)=[x≤y].
 11. A non-transitory machine-readable storage medium encoded with instructions for performing a secure comparison between a first secret data and a second secret data, comprising: instructions for receiving, by a processor of a first party,

encrypted bits of the second secret data y from a second party, where

is an integer; instructions for computing the Hamming weight h of first secret data x, wherein x has

bits; instructions for computing the value of a first comparison bit δ_(A) such that δ_(A)=0 when h>└

/2┘, δ_(A)=1 when h<┌

/2┐, and δ_(A) is randomly selected when h=

/2; instructions for forming a set of └

/2┘ indexes

that includes at least the indexes i where x_(i)=δ_(A); instructions for selecting random invertible scalars r_(i) for each i in

and computing

c* _(i)

=(

1+(1−2δ_(A))x _(i)

·

y _(i)

^(2δ) ^(A) ⁻¹·(

x _(j) ⊕y _(j)

))^(r) ^(i) wherein

w

denotes the homomorphic encryption of w using a cryptographic key of the second party; instructions for selecting random invertible scalars r⁻¹ and computing

c* ⁻¹

=(

δ_(A)

·

x _(j) ⊕y _(j)

)^(r) ⁻¹ ; instructions for transmitting ciphertexts

c*_(i)

in a random order to the second party.
 12. The non-transitory machine-readable storage medium of claim 11, wherein when the second party sets a value of a second comparison bit δ_(B) based upon the decrypted c*_(i)'s and wherein δ_(A)⊕δ_(B)=[x≤y].
 13. The non-transitory machine-readable storage medium of claim 12, wherein when the second party sets a second comparison bit δ_(B)=1 when any one of the decrypted c*_(i)'s is equal to zero.
 14. The non-transitory machine-readable storage medium of claim 12, wherein when the second party sets a second comparison bit δ_(B)=0 when none of the decrypted c*_(i)'s is equal to zero.
 15. The non-transitory machine-readable storage medium of claim 11, wherein the encryption uses the Pallier cryptosystem.
 16. The non-transitory machine-readable storage medium of claim 11, wherein the encryption uses the exponential variant of the ElGamal cryptosystem.
 17. The non-transitory machine-readable storage medium of claim 11, further comprising instructions for receiving an encryption of the second comparison bit δ_(B) from the second party and computing

δ

=

δ_(B)

when δ_(A)=0 and

δ

=

1

·

δ_(B)

⁻¹ when δ_(A)≠0, wherein δ=[x≤y].
 18. A non-transitory machine-readable storage medium encoded with instructions for performing a secure comparison between a first secret data and a second secret data, comprising: instructions for receiving, by a processor of a first party, encrypted second secret data

y

from a second party, wherein where

is the number of bits in y and wherein

y

denotes the additive homomorphic encryption of y; instructions for choosing a random mask ρ in

, where κ is a security parameter; instructions for computing

z^(†)

=

y

·

x

⁻¹·

+ρ

, wherein x is the first secret data having

bits; instructions for sending

z^(†)

to the second party; instructions for computing x′=ρ mod

; instructions for receiving, by the processor of a first party,

encrypted bits of y′ from the second party, wherein y′ is based upon

z^(†)

; instructions for computing the Hamming weight h of x′; instructions for computing the value of a first comparison bit δ′_(A) such that δ′_(A)=0 when h>└

/2┘, δ′_(A)=1 when h<┌

/2┐, and δ′_(A) is randomly selected when h=

/2; instructions for forming a set of └

/2┘ indexes

that includes at least the indexes i where x′_(i)=δ′_(A); instructions for selecting random invertible scalars r_(i) for each i in

and computing

c* _(i)

=(

1+(1−2δ′_(A))x′ _(i)

·

y′ _(i)

^(2δ′) ^(A) ⁻¹·(

x′ _(j) ⊕y′ _(j)

))^(r) ^(i) ; instructions for selecting random invertible scalars r⁻¹ and computing

c* ⁻¹

=(δ′_(A)

·

x′ _(j) ⊕y′ _(j)

)^(r) ⁻¹ ; instructions for transmitting ciphertexts

c*_(i)

in a random order to the second party.
 19. The non-transitory machine-readable storage medium of claim 18, wherein when the second party decrypts

z^(†)

and defines y′=z^(†) mod

.
 20. The non-transitory machine-readable storage medium of claim 18, wherein the first party sets δ_(A)=δ′_(A) when └ρ/

┘ is even, and δ_(A)=1−δ′_(A) otherwise, second party sets a value of a second comparison bit δ_(B)=δ′_(B) when └z^(†)/

┘ is odd, and δ_(B)=1−δ′_(B) otherwise and wherein δ_(A)⊕δ_(B)=[x≤y]. 